@skyhook-io/radar-app 1.9.4 → 1.9.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyhook-io/radar-app",
-  "version": "1.9.4",
+  "version": "1.9.6",
   "description": "Radar's full web UI as a reusable React component. Used by Radar's own binary and by external consumers like Radar Cloud.",
   "repository": {
     "type": "git",
@@ -41,7 +41,7 @@
     "yaml": "^2.9.0"
   },
   "peerDependencies": {
-    "@skyhook-io/k8s-ui": ">=1.10.0",
+    "@skyhook-io/k8s-ui": ">=1.11.0",
     "@tanstack/react-query": ">=5",
     "@xyflow/react": ">=12.0.0",
     "clsx": ">=2",
@@ -60,21 +60,21 @@
     "@tailwindcss/vite": "^4.3.3",
     "@tanstack/react-query": "^5.101.4",
     "@types/node": "^26.1.1",
-    "@types/react": "^19.2.17",
+    "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.4",
     "@xyflow/react": "^12.11.2",
     "clsx": "^2.1.1",
     "elkjs": "^0.11.1",
-    "eslint": "^10.6.0",
+    "eslint": "^10.8.0",
     "eslint-plugin-react-hooks": "^7.1.1",
     "eslint-plugin-react-refresh": "^0.5.3",
-    "globals": "^17.7.0",
-    "lucide-react": "^1.24.0",
-    "postcss": "^8.5.16",
+    "globals": "^17.9.0",
+    "lucide-react": "^1.28.0",
+    "postcss": "^8.5.25",
     "prettier": "^3.9.5",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "react-router-dom": "^7.18.1",
     "tailwind-merge": "^3.6.0",
     "tailwindcss": "^4.3.3",

package/src/App.tsx

@@ -9,7 +9,7 @@ import { DebugOverlay } from './components/DebugOverlay'
 import { GlobalDiagnoseButton } from './components/diagnose/LocalDiagnoseAction'
 import { useDiagnoseLayout } from './components/diagnose/DiagnoseContext'
 import { DiagnoseSurface } from './components/diagnose/DiagnoseSurface'
-import { TopologyGraph, TopologySearch, TopologyBreadcrumb, TopologyFilterSidebar, TopologyControls, FreshnessControl, gitOpsRouteForKind, gitOpsRouteForResource, ScopePill, PaneLoader } from '@skyhook-io/k8s-ui'
+import { TopologyGraph, TopologySearch, TopologyBreadcrumb, TopologyFilterSidebar, TopologyControls, FreshnessControl, gitOpsRouteForKind, gitOpsRouteForResource, ScopePill, PaneLoader, assetUrl } from '@skyhook-io/k8s-ui'
 import { initNavigationMap } from '@skyhook-io/k8s-ui/utils/navigation'
 import { useAPIResources, findAPIResourceForRoute } from './api/apiResources'
 import { TimelineView } from './components/timeline/TimelineView'
@@ -33,6 +33,7 @@ import { DockProvider, BottomDock, useDock, useDockReservedHeight, useOpenLocalT
 import { DURATION_DOCK } from '@skyhook-io/k8s-ui/utils/animation'
 import { ContextSwitcher } from './components/ContextSwitcher'
 import { NamespaceSwitcher, type NamespaceSwitcherHandle } from './components/NamespaceSwitcher'
+import { CloudFunnelButton } from './components/CloudFunnelButton'
 import { useNavCustomization } from './context/NavCustomization'
 import type { FleetTakeoverTarget } from './context/NavCustomization'
 import { PrimaryNavRail } from './components/nav/PrimaryNavRail'
@@ -68,6 +69,8 @@ import { type OmnibarHandle } from './components/ui/Omnibar'
 import { RadarOmnibar } from './components/ui/RadarOmnibar'
 import type { ContextSwitcherHandle } from './components/ContextSwitcher'
 
+const radarLogoUrl = assetUrl('/images/radar/radar-icon.svg')
+
 // All possible node kinds (core + GitOps)
 const ALL_NODE_KINDS: NodeKind[] = [
   'Internet', 'Ingress', 'Gateway', 'HTTPRoute', 'GRPCRoute', 'TCPRoute', 'TLSRoute',
@@ -1878,6 +1881,11 @@ function AppInner({ manageDocumentTitle = false, documentTitleSuffix, onClusterL
           {/* AI investigations (self-hides when no agent CLI is present) */}
           <GlobalDiagnoseButton />
 
+          {/* Radar Cloud funnel — OSS-only chrome, same gate as the star.
+              Cloud embeds render chromeless anyway; the explicit gate is
+              belt-and-braces for future chrome-bearing embedders. */}
+          {!navCustomization.embedded && <CloudFunnelButton />}
+
           {/* Local terminal */}
           {capabilities.localTerminal && (
             <Tooltip content="Open local terminal">
@@ -2566,7 +2574,7 @@ function Logo() {
     <div className="flex items-center gap-2.5">
       <div className="relative w-7 h-7 rounded-lg overflow-hidden flex-shrink-0 bg-emerald-500/10 border border-emerald-500/20">
         <img
-          src="/images/radar/radar-icon.svg"
+          src={radarLogoUrl}
           alt=""
           aria-hidden
           className="w-full h-full p-0.5"

package/src/api/client.authRedirect.test.ts

@@ -0,0 +1,194 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+// Deterministic config so the 401 handler's basename/routePath math is fixed and
+// independent of window/env. client.ts only consumes these six exports.
+vi.mock('./config', () => ({
+  getApiBase: () => '/api',
+  getAuthHeaders: () => ({}),
+  getCredentialsMode: () => 'include' as RequestCredentials,
+  getBasename: () => '',
+  routePath: (p: string) => p,
+  stripBasename: (p: string) => p,
+}))
+
+interface NavRecorder {
+  count: number
+  urls: string[]
+}
+
+// Stub window.location (counting href assignments + reloads) and sessionStorage.
+// Runs in vitest's node environment — there is no real DOM.
+function installDom(pathname = '/traffic'): NavRecorder {
+  const rec: NavRecorder = { count: 0, urls: [] }
+  const location: Record<string, unknown> = {
+    pathname,
+    search: '',
+    _href: `http://radar.local${pathname}`,
+    reload: () => {
+      rec.count++
+      rec.urls.push('[reload]')
+    },
+  }
+  Object.defineProperty(location, 'href', {
+    get() {
+      return location._href as string
+    },
+    set(v: string) {
+      rec.count++
+      rec.urls.push(v)
+      location._href = v
+    },
+  })
+  vi.stubGlobal('window', { location })
+
+  const store = new Map<string, string>()
+  vi.stubGlobal('sessionStorage', {
+    getItem: (k: string) => (store.has(k) ? (store.get(k) as string) : null),
+    setItem: (k: string, v: string) => {
+      store.set(k, String(v))
+    },
+  })
+  return rec
+}
+
+// A 401 whose body advertises the auth mode, matching what the backend returns
+// on a protected /api/* call with no session.
+function make401(authMode: string): Response {
+  const body = JSON.stringify({ authMode })
+  return {
+    status: 401,
+    ok: false,
+    clone() {
+      return make401(authMode)
+    },
+    async json() {
+      return JSON.parse(body)
+    },
+  } as unknown as Response
+}
+
+beforeEach(() => {
+  // Reset module state so the redirect gate starts fresh.
+  vi.resetModules()
+  vi.unstubAllGlobals()
+  vi.restoreAllMocks()
+})
+
+describe('apiFetch OIDC 401 -> login redirect (single-flight)', () => {
+  it('navigates to /auth/login exactly once for a burst of concurrent 401s', async () => {
+    const rec = installDom('/traffic')
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => make401('oidc')),
+    )
+    const { apiFetch } = await import('./client')
+
+    // Mirror first paint / mid-session expiry: many protected calls 401 together.
+    const paths = [
+      '/connection',
+      '/capabilities',
+      '/namespaces',
+      '/portforwards',
+      '/dashboard',
+      '/issues',
+      '/auth/me',
+      '/topology',
+    ]
+    await Promise.all(paths.map((p) => apiFetch(`/api${p}`)))
+
+    expect(rec.count).toBe(1)
+    expect(rec.urls).toEqual(['/auth/login'])
+  })
+
+  it('still redirects on the first 401 (guard does not suppress the initial navigation)', async () => {
+    const rec = installDom('/traffic')
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => make401('oidc')),
+    )
+    const { apiFetch } = await import('./client')
+
+    await apiFetch('/api/connection')
+
+    expect(rec.count).toBe(1)
+    expect(rec.urls).toEqual(['/auth/login'])
+  })
+
+  it('re-redirects after the throttle window (self-heals canceled nav / bfcache Back)', async () => {
+    const rec = installDom('/traffic')
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => make401('oidc')),
+    )
+    const nowSpy = vi.spyOn(Date, 'now')
+    const { apiFetch } = await import('./client')
+
+    nowSpy.mockReturnValue(1_000_000)
+    await apiFetch('/api/connection')
+    expect(rec.count).toBe(1)
+
+    // Within the window a repeat 401 is suppressed (no state rotation).
+    nowSpy.mockReturnValue(1_000_000 + 2_000)
+    await apiFetch('/api/connection')
+    expect(rec.count).toBe(1)
+
+    // Past the window it redirects again instead of stalling until a hard reload.
+    nowSpy.mockReturnValue(1_000_000 + 6_000)
+    await apiFetch('/api/connection')
+    expect(rec.count).toBe(2)
+  })
+
+  it('still redirects (once) when sessionStorage is blocked', async () => {
+    // Simulate private-mode / sandboxed storage where every access throws.
+    const rec = installDom('/traffic')
+    vi.stubGlobal('sessionStorage', {
+      getItem: () => {
+        throw new DOMException('blocked', 'SecurityError')
+      },
+      setItem: () => {
+        throw new DOMException('blocked', 'SecurityError')
+      },
+    })
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => make401('oidc')),
+    )
+    const { apiFetch } = await import('./client')
+
+    // Fail-open: the throwing read must not abort the redirect...
+    await Promise.all(
+      ['/connection', '/capabilities', '/namespaces'].map((p) => apiFetch(`/api${p}`)),
+    )
+    // ...and the in-memory fallback still collapses the burst to one navigation.
+    expect(rec.count).toBe(1)
+    expect(rec.urls).toEqual(['/auth/login'])
+  })
+
+  it('does not navigate to /auth/login when already on an /auth path', async () => {
+    const rec = installDom('/auth/login')
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => make401('oidc')),
+    )
+    const { apiFetch } = await import('./client')
+
+    await apiFetch('/api/connection')
+
+    expect(rec.count).toBe(0)
+    expect(rec.urls).toEqual([])
+  })
+
+  it('proxy/unknown mode reloads (once) instead of hitting /auth/login', async () => {
+    const rec = installDom('/traffic')
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => make401('proxy')),
+    )
+    const { apiFetch } = await import('./client')
+
+    await apiFetch('/api/connection')
+
+    expect(rec.urls).toEqual(['[reload]'])
+    expect(rec.urls).not.toContain('/auth/login')
+  })
+})

package/src/api/client.trace.test.ts

@@ -0,0 +1,37 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { runInClusterMerged } from './client'
+
+// The in-cluster endpoint returns a JSON body on denial too, and a Hub
+// ingress/chi timeout returns HTML. Every branch must surface as a thrown
+// error with the truthful message - a partial body painted as a
+// server-finalized trace would be a fabricated result.
+const respond = (status: number, body: string, contentType = 'application/json') =>
+  vi.stubGlobal('fetch', () =>
+    Promise.resolve(new Response(body, { status, headers: { 'Content-Type': contentType } })),
+  )
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+describe('runInClusterMerged error surfacing', () => {
+  it('rejects a denial with the server message', async () => {
+    respond(403, JSON.stringify({ error: 'your Radar Cloud role cannot run an in-cluster reachability test' }))
+    await expect(runInClusterMerged('Service', 'prod', 'web')).rejects.toThrow(/Cloud role/)
+  })
+
+  it('rejects a 200 that carries an error field', async () => {
+    respond(200, JSON.stringify({ error: 'no eligible routes' }))
+    await expect(runInClusterMerged('Service', 'prod', 'web')).rejects.toThrow('no eligible routes')
+  })
+
+  it('rejects a non-JSON gateway failure with the status, not a parse error', async () => {
+    respond(504, '<html>Gateway Timeout</html>', 'text/html')
+    await expect(runInClusterMerged('Service', 'prod', 'web')).rejects.toThrow('In-cluster test failed (504)')
+  })
+
+  it('resolves a clean run with the finalized payload', async () => {
+    respond(200, JSON.stringify({ trace: { subject: { kind: 'Service', name: 'web' } }, inClusterTests: [] }))
+    await expect(runInClusterMerged('Service', 'prod', 'web')).resolves.toMatchObject({ inClusterTests: [] })
+  })
+})

package/src/api/client.ts

@@ -68,6 +68,49 @@ const COST_TREND_REFRESH_INTERVAL_MS = 120_000;
 const CHANGES_REFRESH_INTERVAL_MS = 60_000;
 const APPLICATIONS_REFRESH_INTERVAL_MS = 60_000;
 
+// Throttle window for the OIDC login redirect. On first paint (and again on
+// mid-session session expiry) many protected /api/* requests can 401 in the same
+// tick; without a guard each 401 independently navigates to /auth/login, and each
+// /auth/login regenerates the single radar_oidc_state cookie — so callbacks from
+// earlier redirects fail state validation (or get their token exchange canceled)
+// and the login loops until one happens to win. A short time gate collapses the
+// burst to one navigation while still self-recovering if that navigation is
+// canceled or the page is restored from bfcache (module/JS-realm state survives
+// bfcache, so a plain latch would stick). Mirrors the proxy branch's reload
+// throttle below.
+const OIDC_LOGIN_REDIRECT_THROTTLE_MS = 5000;
+const OIDC_LOGIN_REDIRECT_KEY = "radar_oidc_login_redirect";
+
+// In-memory fallback for when sessionStorage is unavailable (private mode,
+// sandboxed/blocked storage). A timestamp, not a boolean latch, so it still
+// self-heals within the throttle window instead of sticking.
+let lastOidcLoginRedirectAt = 0;
+
+// Fail open: if reading storage throws, fall back to the in-memory timestamp so
+// the redirect still fires. Otherwise the 401 handler would reject before
+// redirecting and strand the user on a "not signed in" screen.
+function lastOidcLoginRedirect(): number {
+  try {
+    const stored = sessionStorage.getItem(OIDC_LOGIN_REDIRECT_KEY);
+    if (stored) {
+      const parsed = parseInt(stored);
+      if (!Number.isNaN(parsed)) return parsed;
+    }
+  } catch {
+    /* storage blocked — use the in-memory fallback */
+  }
+  return lastOidcLoginRedirectAt;
+}
+
+function markOidcLoginRedirect(now: number): void {
+  lastOidcLoginRedirectAt = now;
+  try {
+    sessionStorage.setItem(OIDC_LOGIN_REDIRECT_KEY, String(now));
+  } catch {
+    /* best-effort — the in-memory fallback still throttles this realm */
+  }
+}
+
 // Wrapper around fetch that always includes credentials (for session cookies)
 // and handles 401 responses globally. Merges caller-provided headers with
 // auth headers from the config module so library consumers (Radar Hub) can
@@ -112,7 +155,15 @@ export function apiFetch(
       }
 
       if (authMode === "oidc") {
-        window.location.href = routePath("/auth/login");
+        // Only the first 401 in a burst navigates; concurrent 401s within the
+        // window are suppressed so they don't rotate radar_oidc_state. The gate
+        // is time-based, so a canceled navigation or bfcache Back re-auths on the
+        // next 401 instead of stalling until a hard reload.
+        const now = Date.now();
+        if (now - lastOidcLoginRedirect() > OIDC_LOGIN_REDIRECT_THROTTLE_MS) {
+          markOidcLoginRedirect(now);
+          window.location.href = routePath("/auth/login");
+        }
       } else {
         // Proxy mode or unknown — reload is safe for both (proxy re-injects headers,
         // unknown avoids redirecting to /auth/login which doesn't exist in proxy mode).
@@ -626,6 +677,85 @@ export function useResourceIssues(
   });
 }
 
+import type { Trace as NetworkTrace, InClusterCapability } from '@skyhook-io/k8s-ui'
+
+// useTrace polls the static path-shaped diagnosis for one network entry
+// kind. 5s refetch + 15s staleTime keeps the drawer feeling live without
+// burning request budget; probes are deliberately excluded - they run via
+// fetchTraceWithProbes on operator click.
+export function useTrace(kind: string, namespace: string, name: string, enabled = true) {
+  return useQuery<NetworkTrace>({
+    queryKey: ['trace', kind, namespace, name, 'static'],
+    queryFn: () => fetchJSON(`/trace/${kind}/${namespace}/${name}`),
+    staleTime: 15000,
+    refetchInterval: enabled ? 5000 : false,
+    enabled: enabled && Boolean(kind) && Boolean(namespace) && Boolean(name),
+  })
+}
+
+// fetchTraceWithProbes is one-shot rather than polled: probes generate real
+// network traffic that observability systems can see, so they are NOT polled.
+// They fire on an explicit, scoped trigger - the operator clicking Run, or
+// opening the Reachability tab for a resource (auto-run once per resource, so the
+// tab shows results instead of a blank "click Run" page) - never on every render
+// or background refresh. The in-cluster probe (which spawns a Job) stays
+// click-only.
+export function fetchTraceWithProbes(kind: string, namespace: string, name: string, path?: string): Promise<NetworkTrace> {
+  const q = path && path !== '/' ? `&path=${encodeURIComponent(path)}` : ''
+  return fetchJSON(`/trace/${kind}/${namespace}/${name}?probe=true${q}`)
+}
+
+// fetchInClusterCapability tells the UI whether the active "test from inside the
+// cluster" probe can run for this caller (and names the cluster + namespace).
+export function fetchInClusterCapability(kind: string, namespace: string, name: string): Promise<InClusterCapability> {
+  return fetchJSON(`/trace/${kind}/${namespace}/${name}/probe-in-cluster/capability`)
+}
+
+// InClusterMergedResult is the WHOLE-subject in-cluster test: the server runs every
+// route's live probe, folds them in via the canonical trace.ApplyInClusterResults,
+// and returns the FINALIZED trace - so the frontend displays it directly instead of
+// reimplementing a weaker merge that could falsely confirm a sibling route.
+// InClusterTestOutcome is one route's in-cluster result. A failure (the Job
+// couldn't start / timed out / RBAC) comes back as HTTP 200 with a human status
+// and a copyable fallbackCommand - it MUST be surfaced, not dropped.
+export interface InClusterTestOutcome {
+  route: string
+  target?: string
+  status?: string
+  fallbackCommand?: string
+  // Raw probe results when the run produced any. A status WITH results is
+  // informational context; a status WITHOUT results means the route (or the
+  // whole subject) was not tested and the status must be surfaced.
+  results?: unknown[]
+}
+
+export interface InClusterMergedResult {
+  trace: NetworkTrace
+  inClusterTests?: InClusterTestOutcome[]
+}
+
+// runInClusterMerged triggers the whole-subject in-cluster test and returns the
+// server-finalized trace. The endpoint returns a JSON body on denial too, so
+// parse the body either way and surface the error field.
+export async function runInClusterMerged(kind: string, namespace: string, name: string, path?: string): Promise<InClusterMergedResult> {
+  const response = await apiFetch(`${getApiBase()}/trace/${kind}/${namespace}/${name}/in-cluster`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ path: path ?? '/' }),
+  })
+  // A gateway/proxy failure (chi's 60s timeout, a Hub ingress 502) returns
+  // HTML - an unguarded .json() surfaced "Unexpected token <" instead of the
+  // status. Mirror fetchJSON's tolerant parse.
+  const body = await response.json().catch(() => undefined)
+  if (!response.ok || body?.error) {
+    throw new Error(body?.error || `In-cluster test failed (${response.status})`)
+  }
+  if (body === undefined) {
+    throw new Error('In-cluster test returned an unreadable response')
+  }
+  return body
+}
+
 // Audit settings
 export interface AuditSettings {
   ignoredNamespaces: string[];
@@ -1545,6 +1675,190 @@ export function useCapabilities() {
   });
 }
 
+// ============================================================================
+// In-product Cloud Connect (driver lane)
+// ============================================================================
+
+export interface CloudInstallRecoveryGuidance {
+  summary: string
+  lines?: string[]
+  inspect?: string[]
+  clusterUrl?: string
+}
+
+export interface CloudInstallPlanSummary {
+  mode: 'fresh' | 'adopt'
+  contextName: string
+  namespace: string
+  release: string
+  defaultClusterName: string
+  targetChartVersion: string
+  targetAppVersion: string
+  currentChartVersion?: string
+  currentRevision?: number
+  currentImageTag?: string
+  preservedImageRepository?: string
+  uncertainty?: string
+  advisories?: string[]
+  sharedListener?: boolean
+}
+
+export interface CloudInstallConnected {
+  clusterId: string
+  clusterUrl: string
+  trackCommand: string
+  rollback?: CloudInstallRecoveryGuidance
+}
+
+export interface CloudInstallFailure {
+  kind: string
+  message: string
+  guidance?: CloudInstallRecoveryGuidance
+  retrySafe: boolean
+}
+
+export interface CloudInstallBlocked {
+  reason: 'gitops' | 'preflight' | 'unsupported'
+  message: string
+  blocking?: string[]
+}
+
+export type CloudInstallState =
+  | 'idle'
+  | 'preparing'
+  | 'ready'
+  | 'starting'
+  | 'awaiting_approval'
+  | 'provisioning'
+  | 'waiting_tunnel'
+  | 'connected'
+  | 'failed'
+  | 'blocked'
+
+export interface CloudInstallStatus {
+  flowId?: string
+  state: CloudInstallState
+  plan?: CloudInstallPlanSummary
+  clusterName?: string
+  connectUrl?: string
+  connected?: CloudInstallConnected
+  failure?: CloudInstallFailure
+  blocked?: CloudInstallBlocked
+}
+
+export const cloudInstallActive = (state: CloudInstallState | undefined): boolean =>
+  state === 'preparing' ||
+  state === 'ready' ||
+  state === 'starting' ||
+  state === 'awaiting_approval' ||
+  state === 'provisioning' ||
+  state === 'waiting_tunnel';
+
+// Poll while a flow is live so progress renders in near-real-time; the flow
+// itself is server-owned, so this hook merely observes (and re-attaches after
+// a page reload). gcTime 0: never cache connect-flow payloads.
+// What the Hub says about connecting to it. Fetched from the Hub itself, not
+// from Radar's API, so the dialog states current terms instead of whatever was
+// compiled into this binary months ago — a stale free-tier claim is a promise
+// Radar can't keep. Every field is optional and falls back per-field, so a Hub
+// that doesn't serve this (self-hosted, older, offline) renders exactly what
+// Radar renders today.
+export interface CloudConnectInfo {
+  assurances?: string[]
+  notice?: string
+}
+
+// Deliberately a bare cross-origin GET: no credentials, no identifiers, no
+// params. The Hub learns only what any HTTP request reveals.
+export function useCloudConnectInfo(apiUrl: string | undefined, enabled: boolean) {
+  return useQuery<CloudConnectInfo>({
+    queryKey: ["cloud-connect-info", apiUrl],
+    queryFn: async () => {
+      const res = await fetch(`${apiUrl}/api/connect/info`, {
+        credentials: "omit",
+        signal: AbortSignal.timeout(4000),
+      });
+      if (!res.ok) throw new Error(`connect info: ${res.status}`);
+      return res.json();
+    },
+    // No apiUrl means the server decided this deployment must not fetch.
+    enabled: enabled && !!apiUrl,
+    staleTime: 5 * 60 * 1000,
+    retry: false,
+  });
+}
+
+export function useCloudInstallStatus(enabled: boolean) {
+  const queryClient = useQueryClient()
+  const query = useQuery<CloudInstallStatus>({
+    queryKey: ['cloud-install-status'],
+    queryFn: () => fetchJSON('/cloud/install/status'),
+    enabled,
+    gcTime: 0,
+    staleTime: 0,
+    refetchInterval: (q) => (cloudInstallActive(q.state.data?.state) ? 1500 : false),
+  })
+  return {
+    ...query,
+    invalidate: () => queryClient.invalidateQueries({ queryKey: ['cloud-install-status'] }),
+  }
+}
+
+// In-cluster Radar describing its own installation, so the modal can route to
+// the right handoff instead of a generic signup link.
+export interface CloudConnectSelf {
+  ownership: 'helm' | 'gitops' | 'ambiguous' | 'unknown'
+  namespace?: string
+  release?: string
+  deploymentName?: string
+  chart?: string
+  controller?: string
+  wizardUrl?: string
+}
+
+export function useCloudConnectSelf(enabled: boolean) {
+  return useQuery<CloudConnectSelf>({
+    queryKey: ['cloud-connect-self'],
+    queryFn: () => fetchJSON('/cloud/connect/self'),
+    enabled,
+    staleTime: 60000,
+  })
+}
+
+export function prepareCloudInstall(): Promise<CloudInstallStatus> {
+  return fetchJSON('/cloud/install/prepare', { method: 'POST' })
+}
+
+export function startCloudInstall(body: {
+  flowId: string
+  clusterName: string
+  acceptAdoption?: boolean
+  acknowledgeIncompleteDiscovery?: boolean
+  acknowledgeSharedListener?: boolean
+}): Promise<CloudInstallStatus> {
+  return fetchJSON('/cloud/install/start', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(body),
+  })
+}
+
+export function cancelCloudInstall(flowId: string): Promise<CloudInstallStatus> {
+  return fetchJSON('/cloud/install/cancel', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ flowId }),
+  })
+}
+
+export function dismissCloudInstall(flowId: string): Promise<CloudInstallStatus> {
+  return fetchJSON('/cloud/install/dismiss', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ flowId }),
+  })
+}
+
 // Namespace-scoped capabilities. Users with namespace-scoped RoleBindings may
 // have these permissions in specific namespaces.
 export function useNamespaceCapabilities(